Privacy policy

1. Controller

Ostvestment GmbH
Emilienstraße 21, 04107 Leipzig
reachable for LE-cozy matters at: anfrage@le-cozy.de

2. Request form

Data entered in the request form (name, email, phone, travel dates, message) is used solely to process your request and — if configured — forwarded to our internal booking system. It is not shared with third parties except as required to fulfil a booking.

To protect against automated spam/bot submissions, the form embeds Cloudflare Turnstile — a human-verification service by Cloudflare, Inc. When the form loads, a small verification script is loaded from Cloudflare's servers; on submission, the resulting verification token is validated server-side against Cloudflare before your request is processed. This can transmit technical data (e.g. IP address, browser characteristics) to Cloudflare. Details: Cloudflare's privacy policy at cloudflare.com/privacypolicy.

3. Cookies, local storage & external embeds

This website itself sets no cookies of its own and uses no local storage (localStorage/sessionStorage) of its own in the browser. No analytics, map or review widgets are embedded. The fonts (Newsreader, Inter) are self-hosted or bundled at build time — no connection to Google servers happens in the visitor's browser for this.

Cloudflare Turnstile (see section 2) runs a client-side security check when the request form loads. Per Cloudflare's own documentation, Turnstile can operate in the standard configuration used here without setting its own cookies or local storage on your device; an extended "pre-clearance" feature that would change this is not enabled in this project. Independently of that, loading and checking does transmit technical data (e.g. IP address, browser characteristics) to Cloudflare (see section 2) — that concerns data processing under the GDPR, a question of legal basis distinct from the question of access to your end device under Sec. 25 of the German TDDDG.

Online booking via Smoobu is currently not active as an embedded booking widget (iframe) on this website — the booking page currently leads directly to our request form. Once the Smoobu booking flow is embedded again, we will extend this section with the technical details that then apply (including that it runs as its own, foreign cross-origin frame whose inside — for instance whether and which cookies Smoobu itself sets there — we have no visibility into). Details on Smoobu's own data processing in general: the privacy policy of the provider Smoobu (smoobu.com).

Two places link to external sites without embedding them: the "What guests say" section links per apartment to the public Airbnb review page, and the location section links to a route map on OpenStreetMap. Both are plain links (their own tab, no iframe) — nothing from the external site loads until you deliberately click, so neither triggers any processing on this website itself.

4. Digital access management (Bold, Ring)

For self check-in you install the Bold app (both apartments) and, additionally, Ring (LE-cozy Musikviertel Apt. 02 only) directly from the respective app store. Both services are operated by their own providers, not by LE-cozy/Ostvestment GmbH. This website itself does not collect or store any access codes, passwords or other access credentials.

Bold and Ring each process the data required to activate access independently, as their own providers. Details on this — including processing location, internal access rights and retention periods — are governed by Bold's and Ring's own privacy policies; this page makes no independent statement about them.

5. Hosting & server logs

This website is hosted and delivered via the Vercel Inc. (USA) platform. As processor, Vercel processes technical access data such as IP address, requested page/resource, timestamps and browser/device information, as technically required to operate a hosting/CDN service. Vercel does not state a fixed retention period for this access data; per its own privacy notice, data is retained only as long as necessary for the respective purpose. Since Vercel also processes data outside the EU/EEA, Vercel relies, per its own documentation, on standard contractual clauses as well as the EU-U.S. Data Privacy Framework. Details: Vercel's privacy notice (vercel.com/legal/privacy-notice) and data processing agreement (vercel.com/legal/dpa).

6. Your rights

As a data subject, you generally have the following rights under the GDPR vis-à-vis the controller: the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability where applicable (Art. 20 GDPR), and objection to processing (Art. 21 GDPR). You also have the right to lodge a complaint with the data protection supervisory authority responsible for the controller's location. This list is a factual overview and does not replace individual legal advice; for specific concerns, please contact the address given in section 1 above.